Troubleshooting
Problem
After implementing a new GoDaddy certificate, the Google Chrome web browser reports the website as untrusted. The server certificate is issued by GoDaddy TLS Intermediate CA DV - R1v1 -> GoDaddy TLS Root CA - R1 and is assigned to the IBM HTTP Server application definition. Despite the presence of the R1-to-G2 cross certificate and the G2 root in the *SYSTEM store, the HTTP server presents a chain ending in the self-signed R1 root, leading to a 'self-signed certificate in certificate chain' error (Verify return code: 19) in OpenSSL and trust issues in Chrome.
Symptom
IBM i System TLS handshakes reply with a self-signed GoDaddy TLS Root CA - R1 instead of the expected R1-to-G2 cross-signed chain for a GoDaddy-issued server certificate.
This results in Chrome not trusting the site due to the self-signed R1 Root certificate in the chain. The server certificate is in the DCM *SYSTEM store and is issued by GoDaddy TLS Intermediate CA DV - R1v1. The *SYSTEM store contains the enabled GoDaddy Root Certificate Authority – G2, the R1v1 intermediate, the self-signed GoDaddy TLS Root CA – R1, and the enabled GoDaddy TLS Root CA – R1 to G2 Cross Certificate. Despite the presence of the cross-certificate, the server presents a chain ending in the self-signed R1 root.
Cause
The issue is caused by the IBM i serving a self-signed GoDaddy TLS Root CA - R1 certificate instead of the R1-to-G2 cross-signed chain. This results in the public website being untrusted by Chrome since they do not currently trust the GoDaddy TLS Root CA - R1. The problem arises because the certificate chain presented includes the self-signed R1 root instead of the cross-signed chain.
Resolving The Problem
To resolve the issue , follow these steps:
1. Download the GoDaddy R1 to G2 Cross Certificate & GoDaddy TLS Intermediate CA DV - R1v1. All GoDaddy CA certificates can be found here.
2. Export the server/client GoDaddy certificate to a *.pfx file.
3. Record and un-assign the Server/Client certificate from your applications. (On the "Manage certificates" page -> click + next to your cert -> Assign -> check the boxes next to the same applicaiton definitions -> click Remove)
4. Delete the self-signed 'R1 Root' certificate from the DCM *SYSTEM certificate store.
5. Ensure that the 'R1 DV Int', 'R1->G2 Cross', and 'G2 Root' CA certificates are imported into the *SYSTEM store.
6. Verify the certificate hierarchy to confirm the correct chain: 'Personal Cert' → 'R1 DV Int' → 'R1->G2 Cross' → 'G2 Root'.
7. Re-assign the GoDaddy server/client certificate to the same application definitions as before. (On the "Manage certificates" page -> click + next to your cert -> Assign -> check the boxes next to the same applicaiton definitions -> click Replace)
8. Restart the HTTP server instance to pick up the new certificate chain.
This process ensures that the HTTP server presents the correct certificate chain, allowing Google Chrome to trust the site.
Related Information
Document Location
Worldwide
Product Synonym
i5/OS;OS/400;System i operating system;iSeries Operating System;AS/400 operating system;PowerHA for IBM i;PowerHA SystemMirror for IBM i;Db2 Mirror for i;Cloud Storage Solutions for i;Access Client Solutions;Developer Kit for Java for IBM i;HTTP Server for IBM i;Network Authentication Enablement for IBM i;OmniFind Text Search Server for DB2 for IBM i;Portable Utilities for IBM i;TCP/IP Connectivity Utilities for IBM i;Transform Services for IBM i;Cryptographic Device Manager;Query for i;Db2 Query Manager and SWL Development Kit;IBM i Access Family;Rational Development Studio;AS400;IBM i Db2;IBM i Extension for VS Code Enterprise Support;WebSphere Application Server for IBM i
Was this topic helpful?
Document Information
Modified date:
30 September 2026
UID
ibm17290213